Relevance to determine if new applications have been installed on a PC

We have some PCs that are locked down to not get any SCCM pushes. Theres about 10 applications installed on the devices. I need a relevance that will tell me if other apps do get installed. That would tell me that the SCCM exception is not working and the device is potentially getting cluttered with new apps. I have several relevances to list the apps on a device. The best one I have, below, looks in several locations in the registry.

I want to compare a default list of apps that we know should be on the device with the list that it finds using the code below (or other if theres something better or shorter!) and then list if there are apps installed. I would also like to be able to tell how many apps are installed outside of the default list, this could be another relevance. I dont care about versions so the code below does not query that.

Thanks very much for any ideas.

“unique values of (( (value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then (”") else (""))) of keys whose ((not exists value “SystemComponent” of it OR value “SystemComponent” of it as string != “1”) AND (not exists value “WindowsInstaller” of it OR value “WindowsInstaller” of it as string != “1”) AND exists value “UninstallString” of it AND not exists value “ParentKeyName” of it AND exists value “DisplayName” of it) of key “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry) ; (if x64 of operating system then((value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then ("") else (""))) of keys whose ((not exists value “SystemComponent” of it OR value “SystemComponent” of it as string != “1”) AND (not exists value “WindowsInstaller” of it OR value “WindowsInstaller” of it as string != “1”) AND exists value “UninstallString” of it AND not exists value “ParentKeyName” of it AND exists value “DisplayName” of it) of key “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of registry) else nothing) ; ((value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then ("") else (""))) of keys whose ((not exists value “SystemComponent” of it OR value “SystemComponent” of it as string != “1”) AND (not exists value “WindowsInstaller” of it OR value “WindowsInstaller” of it as string != “1”) AND exists value “UninstallString” of it AND not exists value “ParentKeyName” of it AND exists value “DisplayName” of it) of keys “Software\Microsoft\Windows\CurrentVersion\Uninstall” of keys whose (exists key “Software\Microsoft\Windows\CurrentVersion\Uninstall” of it) of key “HKU” of registry) ; ((value “ProductName” of item 0 of it as string & (if (exists value “DisplayVersion” of it) then ("") else ("")) of key “InstallProperties” of item 1 of it) of it whose ((not exists value “SystemComponent” of it OR value “SystemComponent” of it as string != “1”) of key “InstallProperties” of item 1 of it AND exists value “ProductName” of item 0 of it) of (keys of item 0 of it, keys of item 1 of it) whose (name of item 0 of it = name of item 1 of it) of (key “Software\Microsoft\Installer\Products” of item 0 of it, key “Products” of item 1 of it) of (keys of key “HKU” of it, keys of key “HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData” of it) whose ((exists key “Software\Microsoft\Installer\Products” of item 0 of it and exists key “Products” of item 1 of it)) of native registry) ; (elements of (set of ((value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then ("") else (""))) of it whose ((not exists value “SystemComponent” of it OR value “SystemComponent” of it as string != “1”) AND (exists value “WindowsInstaller” of it AND value “WindowsInstaller” of it as string = “1”) AND exists value “DisplayName” of it) of keys “InstallProperties” of items 1 of (keys of key “HKLM\Software\Classes\Installer\Products” of it, keys of key “HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products” of it) whose (name of item 0 of it = name of item 1 of it) of native registry) - set of ((value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then ("") else (""))) of keys whose ((exists value “SystemComponent” of it AND value “SystemComponent” of it as string = “1”) AND (exists value “WindowsInstaller” of it AND value “WindowsInstaller” of it as string = “1”) AND exists value “UninstallString” of it AND not exists value “ParentKeyName” of it AND exists value “DisplayName” of it) of key “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of native registry ; (if (x64 of operating system) then((value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then ("" & value “DisplayVersion” of it as string) else (""))) of keys whose ((exists value “SystemComponent” of it AND value “SystemComponent” of it as string = “1”) AND (exists value “WindowsInstaller” of it AND value “WindowsInstaller” of it as string = “1”) AND exists value “UninstallString” of it AND not exists value “ParentKeyName” of it AND exists value “DisplayName” of it) of key “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of registry) else nothing)))) ; ( (value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then ("") else (""))) of items 1 of (keys of key “HKLM\Software\Classes\Installer\Products” of it, keys of key “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of it) whose ((value “ProductName” of item 0 of it = value “DisplayName” of item 1 of it) AND ((not exists value “SystemComponent” of it OR value “SystemComponent” of it as string != “1”) AND (exists value “WindowsInstaller” of it AND value “WindowsInstaller” of it as string = “1”) AND exists value “UninstallString” of it AND not exists value “ParentKeyName” of it AND exists value “DisplayName” of it) of item 1 of it) of native registry ; (value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then ("") else (""))) of items 1 of (keys of key “HKLM\Software\Classes\Installer\Products” of native registry, keys of key “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of registry) whose ((value “ProductName” of item 0 of it = value “DisplayName” of item 1 of it) AND ((not exists value “SystemComponent” of it OR value “SystemComponent” of it as string != “1”) AND (exists value “WindowsInstaller” of it AND value “WindowsInstaller” of it as string = “1”) AND exists value “UninstallString” of it AND not exists value “ParentKeyName” of it AND exists value “DisplayName” of it) of item 1 of it) ; (value “DisplayName” of it as string & (if (exists value “DisplayVersion” of it) then ("") else (""))) of items 1 of (keys of key “HKLM\Software\Classes\Installer\Products” of it, keys “Software\Microsoft\Windows\CurrentVersion\Uninstall” of keys whose (exists key “Software\Microsoft\Windows\CurrentVersion\Uninstall” of it) of key “HKU” of it) whose ((value “ProductName” of item 0 of it = value “DisplayName” of item 1 of it) AND ((not exists value “SystemComponent” of it OR value “SystemComponent” of it as string != “1”) AND (exists value “WindowsInstaller” of it AND value “WindowsInstaller” of it as string = “1”) AND exists value “UninstallString” of it AND not exists value “ParentKeyName” of it AND exists value “DisplayName” of it) of item 1 of it) of native registry ) )"

That relevance is way too complicated. I should be able to come up with something smaller.

You could look at the InstallDate and if it is after a certain time, then you know something has been installed.

You could also look at the total number of products installed and then fire off a report if that number changes in webreports.

Thanks Jgstew. Yes, a relevance to determine the total number of apps should work. I don’t think I can go by the date since some of the default apps do get updated throughout the year. I would also want to know what got installed outside of the default list, but one thing at a time.

This should be the total number of software installed: (this will work on all windows machines, including 32bit)

number of keys of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries)